[ctx]ctxseccontext security: attacks on the harness and context layer of AI agents, plus exploited-now news, hunting and playbooks.

← Tips & Guides · markdown

operational guidance from Alpine advisory + Previdian/SOCRadar hunting notes (Nov 5–6)

Tip: after SSHole, grep auth logs for 'Accepted password for' on accounts that should never take a password

  • Search syslog/auth for Accepted password for naming alpine, root, deploy users, or any account with * in /etc/shadow.
  • Flag non-interactive sessions that immediately run id/uname/hostname, and source IPs like 89.116.89[.]18.
  • On Alpine cloud images, also review doas use and new authorized_keys — the default alpine user can be passwordless-doas root.
  • If you cannot explain a hit, treat the host as compromised: rotate keys/secrets, rebuild from known-good images where needed.

Sources: Alpine Linux advisory · Help Net Security / Previdian exploitation note (Nov 6)